Today is the last leg of a total of four stations of this year's Big>Days (Helden von Heute) event from Microsoft Austria. I am speaking in the developers track on ALM (Application Lifecycle Management) with Visual Studio Team System (and beyond) together with Georg Drobny from MS Consulting Services. We only have seventy minutes to get this topic across, which really is a challenge when covering such an important topic. But so far, we managed to overrun our alotted time only very little. Let's see how it works out today.

It's been quiet on this blog recently, one reason being that it is conference season again. Last week, I was in Munich for VSone, where I did three talks:

• LINQ to SQL
• ADO.NET Entity Framework
• ADO.NET Data Services

At this very moment, I am at the airport in Frankfurt waiting for my flight back from the ready.for.take.off Visual Studio 2008 / Windows Server 2008 / SQL Server 2008 launch event here in Germany. It was the biggest developer event in Germany so far (7000+ conference participants), and Microsoft gave away quite a nice package of software: VS Standard, TFS with one CAL, Windows Server 2008 Enterprise with 5 CALs plus a voucher for SQL Server 2008 that will be available later this year.

I was staffing ATE (Ask the Experts) at this event, initially for IIS7. However, we were very pleasantly surprised that the attendees showed great interest in TFS / VSTS, so I switched duties to that area (VSTS / TFS is a growing business for me as I do training and consulting for those products). Hopefully this free license will trigger more adoption because Team System is such a great tool!

I updated the TFS Code Comment Checking Policy so that it works with VSTS 20008 RTM. The downloaded labeled as Beta 1 comes with the well-known setup, the changes to the August test version are only minimal: the parser has been updated (to better support C# 3.0), and all projects now target .NET Framework 3.5.

Please use the discussions to report any issues you find.

XSSDetect is a static code analysis tool that helps identify Cross-Site Scripting security flaws found within Web applications. It is able to scan compiled managed assemblies (C#, Visual Basic .NET, J#) and analyze dataflow paths from sources of user-controlled input to vulnerable outputs. It also detects whether proper encoding or filtering has been applied to the data and will ignore such "sanitized" paths. Download

Been following tf4mono development for quite a while, and now there is an installer that works on Windows with .NET 2.0 (more info). Be sure to check out the comments as it doesn't seem to work on a machine with Team Explorer already installed.

I ran into a snag last night - I imported a db schema (created via Visio / Generate) into a DB Pro project in VS 2008 Beta 2 DB Pro edition. Then I tried to build & deploy into SQL Express (the one that comes in the TFS / VSTS preconfigured VPC). And it balked.

The error message on TSD158 I got wasn't like the one described in the MSDN Forums post Extending Timeout on SqlBuildTask, however, I decided to look into the registry anyways. Interestingly enough, the value for the key LongRunningQueryTimeoutSeconds was zero. Increased that to 120, restarted VS, presto: build is now working!

Yesterday, I adapted the code comment checkin policy for Team Foundation Server to work with VSTS 2008 ("Orcas") Beta 2. It is functionally equivalent to version 2.1.1 (download) for Visual Studio Team System 2005, therefore you configure it once for a team project, and then it is used both by 2005 & 2008. However, please note the parser doesn't yet fully understand all C# 3.0 constructs, so there might be "false positives".

Download test version here.

The check-in policy for TFS is revved to v2.1 and it comes with the "Included Paths" and "Excluded Namespaces" features announced earlier on my blog. The release announcement has more details; also, take a look at the screenshot tour of configuring CCCP.

When I released version 2.0 of the TFS CCCP, I also previewed one feature of the planned 2.1 release: included source control paths. That prompted a comment by Klaus that excluding namespaces for eg auto-generated code (think CodeSmith or code generated by GAT / GAX guidances) would be a nice feature too.

So I carved out some time today, and built the UI plus added the necessary code changes. To give you an idea what it will look like, here is a screenshot:

To do: testing, documenting, packaging.

Today, I finally released v2.0 of the code comment checking policy for Team Foundation Server (TFS) / Visual Studio Team System (VSTS) 2005. Two major new features: firstly, you can extend the policy to do more restricitive checks (i.e. verify that the comments are actually in line with the number of parameters). Secondly, you now get an MSBuild task to compute "code comment coverage" during an automated build - independent of VSTS / TFS!

As for future versions, it is already in source control - take the following team project for example:

Currently, you can turn on / off CCCP only for the entire team project. However, checking a unit test project or a Windows Forms smart client is rather pointless (in my opinion at least):

It is much more helpful for library projects that are to be used by different in-house or external customers, where with the help of eg Sandcastle you can create a nice help file. Therefore, vNext will sport a "Paths to check" feature:

I decided to go with include instead of exclude because it is much more explicit with regards what is being checked and what not. Currently, this is only available via source download.

Jimmy Li's article Understanding the TFS Cube gives great insight into the warehouse for Team Foundation Server. Well worth your time if you want to dive into analyzing your projects.

Today, I uploaded a preview of version 2.0 to CodePlex. There are two big ticket new items in comparison to version 1.3:

• Plugin support The TFS checkin policy only tests for existence of code comments. For many applications, this is just fine. However, sometimes you also want to test for completeness of comments (i.e. a refactoring "broke" the documented parameter list). In this case you can use the new extensibility API, which comes with two sample plugins in the cccplibcontrib project. The API allows you to select which checking you want to override or complement, and you get full access to the parsed source file just like the stock implementation ("abuse" for non-code commment checking purposes obviously possible too). If you come up with a cool plugin, be sure to contact me for inclusion into the contrib project!
• MSBuild task This build task lives in cccplib, which is entirely independent of TFS or VSTS (it was written by Matt Ward). Therefore, you can use it eg with CruiseControl.NET or simply as part of the local .*proj files. What's the purpose of this build task anyways? Simple: as part of the build, you get information on "code comment coverage", just like you do with let's say code coverage and unit tests. Currently, you only get an XML file with the report - if you are XSLT-savvy and want to contribute a HTML report transform, let me know!

To get an overview what v2 looks like, how to configure it, etc you might be interested in this demo screen recording.

Buck Hodges has a blog entry on this acquisition. To quote the most interesting part for everyone: "Effective today, TeamPlain is available, at no additional charge, to users who own a Team Foundation Server". If you need a Web interface for TFS, go get it!

Want to know what's next? Check out http://msdn.microsoft.com/teamsystem/futures/

World and dog has been reporting about the Orcas March CTP, so I'll stick with reporting news on released technology: the Visual Studio 2005 SDK Version 4.0 is here. Why is this important? It has all the cool stuff in it for extending VS, VSTS and TFS SP1.

Yesterday was the last day of VSone, the German .NET conference featuring almost all  well-known German speakers. As I had hinted at earlier, I did three talks there, and I still owe the audience of my VSTE DbPro talk a couple of resource links:

• Sachin Rekhi's blog
• Samples project for Microsoft Visual Studion Team Edition 2005 for Database Professionals
• A Security Overview of Microsoft Visual Studio 2005 Team Edition for Database Professionals
• Introducing Visual Studio 2005 Team Edition for Database Professionals (if you weren't awake at this time in the morning <g />)

Once again, the TFS installation guide has been updated (2/5/2007). Download here

I would agree that this is indeed a sensible error message when I were about to add a COM reference to an inproc (DLL) server. However, this is an out of process server, an EXE. This guy (callee) does load in a separate process space from the caller, with a separate instance of the .NET runtime. Someone care to enlighten me why this restriction is in place?

By the way, tlbimp behaves the same way (just to make sure...):

TlbImp : error TI0000 : System.Runtime.InteropServices.COMException - Type library 'OutOfProcServer' was exported from a CLR assembly and cannot be re-imported as a CLR assembly.

If you want to do this (Register Output, C++)

and don't want to get this error message

then start Visual Studio with Run as Administrator. I have SP1 and no Vista supplements installed, so maybe there will be (or already is) an elevation prompt for registering output.

This is so totally pathetic: rolling back a changeset in Team Foundation Version Control. A decent version control simply must have a revert story - mistakes do happen, and when you need to revert a check-in that for the sake of an example has 20+ files associated, the advice in the aforementioned how-to definitely will drive your blood pressure up.

Instead of developing a medical condition, you can go for tfpt - the Team Foundation PowerToys. The command tfpt rollback is your friend.

Shortly after Christmas last year, I started with the Code Comment Checking Policy (read about it here, here and here) for Team Foundation Server. The idea for it was based on Florent Santin's TFSCCPolicy, but it used an entirely different approach (full-blown parser instead of RegEx).

As I never intended to compete with him (after all, we are both MVPs), I contacted him informing him of my endeavours. He liked the approach I took, and offered me take over on CodePlex because he had little time to spend on it anyways. So, at long last, today I set up shop as project coordinator at TFS Code Comment Checking Policy, Formerly Known as TFSCCPolicy.

The latest binaries are available, as well as the source code checked into the repository. If you have ideas on how to improve the feature set, let us know in the User Forum. Same goes for joining the team or letting us know about blog posts or tutorials you wrote.

From the "outsmarting yourself department": Yesterday, I installed Team Explorer on my machine to get access to a CodePlex project. Easy enough, at least that's what I thought. So after installation I went to Visual Studio to configure the server connection, but I ended up not being able to connect:

As I was in a hurry anyways, I decided to leave it at that. Fast forward a few hours, to a different location: a pub. I was discussing IT problems with a friend, and at some point we got to firewalls. That's when I went "Bingo!" - this Vista machine has Privoxy installed, to "emulate" Firefox's Adblock extension (Privoxy does a few things more - check their Web site, it's free). And IE7 is configured to use it as proxy server.

So first thing today was to get back into Visual Studio, try again, and then check the Privoxy logs:

Note to self: The TFS client APIs use Internet Explorer settings when it comes to connecting to the Internet, and Privoxy positively strips requests of certain headers.

Fixing is easy: Tools / Options / Environment / Web Browser:

And then add exceptions for all the TFS servers you need to access:

Security does tend to get in the way. Nothing new here.

Yesterday I finished the first TFS / VSTS course of this year, and I had rebuilt my demo machine with TFS / VSTS SP1 and Office 2007. I have to say that Excel 2007 really shines when you slice & dice the TFS warehouse's cubes. If you are in the PM business on projects, you definitely should upgrade to the new version of Office!

Updates

• TFSCCPolicy and CCCP Merge

As promised, the latest version of CCCP now sports a setup program. Setup is based on WiX, and has been created using SharpDevelop's WiX support. A special thanks flies out to Matt Ward, who provided me with the initial skeleton of this setup project. Please note, however, that you must use the bits from our build server because Beta 3 of SharpDevelop 2.1 doesn't work correctly with this setup project (\Source\Setup\Cccp.Setup.sln).

To give you an idea of the WiX project editing experience inside SharpDevelop I have included two screenshots for you (Matt promised a tutorial for his blog):

Above you can see the project tree plus the main WiX file, below the editing experience for the files included in the setup project:

There are four assemblies included in this setup project, with three being installed to the GAC - only cccppol.dll is copied to the target directory, and it has a registry key associated that enables the policy within VSTS. This is a change to previous versions of the policy that used ILMerge to pack those four assemblies into one.

The only other main change over previous versions is configuration:

The new options make hard-coded values from previous versions accessible to the administrator. Please note that this will force you to remove & then add the policy back to your team project if you used previous versions of CCCP (serialization changed).

I also put together a short screen recording on getting up and running with CCCP (sorry for the low audio quality, but I didn't manage to get Vista & my headset to cooperate nicely):

CCCP12InAction.wmv (1.58 MB)

Finally, here are the downloads:

CCCP12.msi (626.5 KB) [Windows Installer as demonstrated in the video]

CCCP12_Source.zip (1.06 MB) [Source code, BSD-licensed]

With this release I declare the CCCP feature-complete, at least when it comes to the features that I need. If you have further ideas for improvement, let me know by adding a comment to this post. If you find bugs, please let me know too. Oh, and if you like it, let others know!

Post Scriptum: yes, the MSBuild task hasn't been implemented yet. But the policy is done.